CVE-2026-6074: Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-23 · updated 2026-10-26
Weakness: CWE-35

Description

Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory.

Affected products

Intrado 911 Emergency Gateway: Versions 7.x, Versions 6.x, Versions 5.x

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-06.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-06

Get alerted when CVE-2026-6074 or the next vulnerability affects your stack